General

  • Target

    JaffaCakes118_9452f935b6598f74a519eb3b0de56f35053b5b03e6b282dc89b0dd21a8c68e1b

  • Size

    726.4MB

  • Sample

    241228-2q3ejstpdx

  • MD5

    b60b64ca1759378a14e329c2da0584dc

  • SHA1

    a24f921026178c736e0b010e40ab811765a6aece

  • SHA256

    9452f935b6598f74a519eb3b0de56f35053b5b03e6b282dc89b0dd21a8c68e1b

  • SHA512

    a6b18870a7ea44d9deab77d5a260045e0bac8ee7fbbf1db7e673f3c2ada6dad59be680c787c4a6a793d3243698de93b253775812cc55382fb178af2f2a3c8d96

  • SSDEEP

    196608:z8G40ydTNxM5sDGXOQ8TJ1cLWXm3U40Y5eCvWOIsUeF:zbydTNxM5sDN1XmX0ieCvWzbeF

Malware Config

Extracted

Family

raccoon

Botnet

8c3e4aa007fb2f2defacc1f952806f72

C2

http://51.255.211.170/

http://45.15.159.197/

Attributes
  • user_agent

    23591

xor.plain

Targets

    • Target

      JaffaCakes118_9452f935b6598f74a519eb3b0de56f35053b5b03e6b282dc89b0dd21a8c68e1b

    • Size

      726.4MB

    • MD5

      b60b64ca1759378a14e329c2da0584dc

    • SHA1

      a24f921026178c736e0b010e40ab811765a6aece

    • SHA256

      9452f935b6598f74a519eb3b0de56f35053b5b03e6b282dc89b0dd21a8c68e1b

    • SHA512

      a6b18870a7ea44d9deab77d5a260045e0bac8ee7fbbf1db7e673f3c2ada6dad59be680c787c4a6a793d3243698de93b253775812cc55382fb178af2f2a3c8d96

    • SSDEEP

      196608:z8G40ydTNxM5sDGXOQ8TJ1cLWXm3U40Y5eCvWOIsUeF:zbydTNxM5sDN1XmX0ieCvWzbeF

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks